Security & Memory Hotfix Available for V18 Update 3

[Keith Winhall_3CX]

A hotfix is available for V18 Update 3 which addresses the following:

• Fix for a security vulnerability
• Fix of memory leak affecting business systems in particular conditions
• Fix for application crash of the call manager if under DDOS attack.

We urge you to install the Hotfix as soon as possible to keep your 3CX system secure...

Continue reading the Original Blog Post.

 

[CentrexJ]

This is showing on consoles as a beta release. Is an official non-beta coming out? Is this recommended or not recommended for production environments then?

 

[Vitamin V]

I read the full article and it mentioned that the Hotfix will be out of Beta status tomorrow.
I plan to hold off on applying until it's a general release Hotfix.

My question is if it will be an applied if Automatic Updates are enabled? We tend to do those over the weekend on client systems.

 

[CentrexJ]

Release versions auto update.

 

[StefanW]

The final release (will maintain the same build number) has been moved to Monday.

If you install now beta U3 (Build 461), you do not have to reinstall anything on Monday.
(Permitting we do not need to touch the release for what ever reason again)

 

[Alphabetic]

Do we need to be concerned on this vulnerability until Monday?

 

[StefanW]

Do you run 3CX on Windows? Then update!

 

[Alphabetic]

Do you run 3CX on Windows? Then update!

No - all debian.

 

[Nick W]

Do we need to be concerned on this vulnerability until Monday?

Same question. Linux or 3CX issue?

 

[StefanW]

In any case, you should update for the given reasons of stability and memory consumption.
The build will mostly be the same on Monday, therefore you don't have to do it twice.
Windows customers should apply the update asap.

 

[mcsphones]

In any case, you should update for the given reasons of stability and memory consumption.
The build will mostly be the same on Monday, therefore you don't have to do it twice.
Windows customers should apply the update asap.

I appreciate this insight (Windows users should update ASAP) but can you give any additional info what the issues this patch fixes or resolves are?

 

[NickD_3CX]

I appreciate this insight (Windows users should update ASAP) but can you give any additional info what the issues this patch fixes or resolves are?

We will not be making details of this public as this would make users still in the process of getting to V18 U3 Hotfix vulnerable.

All we will say is what was said above, if you have installed 3CX on Windows, we highly recommend installing this asap.

 

[Eric @ HTD]

Thank you, Update added to our windows system... short down time and all complete with no issues.

 

[MMDTerry]

So is it actively exploited or POC? If it's being actively exploited a heads up to go looking for signs of intrusion would be great.

 

[IT Consulting Lucke]

System crashed.
3CX on Proxmox 7.1.10 PVE in VM:
Ran Update, SSH still alive but Android App could not connect. Login to Admin Panel ended in Server Error!

 

[Evolute IT]

Proxmox

Proxmox is not supported. However, a basic VM should work fine since it uses KVM as backend.

Login in console and type "(sudo) /usr/sbin/3CXStartServices" to make sure all the services are running.

 

[IT Consulting Lucke]

apt dist-upgrade delivers the same issue.
Proxmox works fine with KVM the last weeks. So it was a kind of surprise to get such an issue.

And yes, bare metal is nice, but if you have a crashed phonesystem it took much longer to "roll it back" to working.
So it was just 1 click and 2 minutes. Love virtualisation for making life much easier... most of the times. ;-)

NGINX status bevor AND after crashed Update:


KVM:

So KVM is maybe not the best choise, but 3CX knows about... ;-)

 

[rasim]

Any more details on the memory leak that was fixed please ? We did notice some issues with higher memory consumption compared to v16

 

[NickD_3CX]

If it's being actively exploited

To our knowledge, no it isn't.

 

[NickD_3CX]

Any more details on the memory leak that was fixed please ? We did notice some issues with higher memory consumption compared to v16

Not much to say really, we did noticed a very slight increase over time, but in this hotfix the part of the code that was causing this was optimized so that this no longer happens.